Third and biggest Addon migrated: menus/addon_remote_access.sh - VNC
(x11vnc), WireGuard, Tailscale, and Netbird, each with its own install/
connect/status/uninstall flow. Same risk class as CUPS (real apt
packages, real system state) but broader in scope: Tailscale and
Netbird install via the vendors' own documented `curl -fsSL <url> | sh`
method, preserved exactly as-is rather than redesigned.
- lib/config.sh: new $WIREGUARD_DIR, same pattern as $SYSTEMD_DIR/
$BIN_DIR/etc - nothing in this file hardcodes /etc/wireguard.
- lib/menu.sh: promoted power_schedule.sh's enable_and_start_timers()
to a shared enable_and_start_units() (works for services now too, not
just timers) - Remote Access needed the identical enable+start-with-
graceful-failure-reporting pattern for x11vnc and wg-quick@, so this
is fixed once and reused rather than duplicated a second time.
power_schedule.sh's four call sites renamed to match.
Found and fixed a real framework-level bug while building this file:
run_menu()'s *handler* call has been `|| true`-guarded since v2.1.0,
but the *status function* call (`"$status_func"` on its own line) was
still completely bare. A status function's entire job is read-only
display, but if it contains so much as a pipeline whose grep matches
nothing - which pipefail turns into a pipeline failure even though the
actual last command in it (e.g. sed) succeeds - that bare call would
crash the *entire session*, not just fail to show status text. Found
while writing wireguard_status()'s `sudo wg show | grep ... | sed ...`
and deliberately verifying its exact failure mode rather than assuming
run_menu already covered it. Fixed once in run_menu() itself
(lib/menu.sh), protecting every status function across every menu -
present and future - the same "fix once at the framework level"
pattern as the v2.1.0 handler fix.
Given the framework fix meant this class of bug had been silently
possible since v2.1.0, audited every existing status function across
every already-migrated menu for the same specific shape (a bare
`var=$(...)` assignment from a grep-based pipeline, not embedded in an
echo and not already guarded - embedded substitutions and if-condition
contexts are both already safe on their own). Found and fixed one real
instance in power_schedule_status(). menus/addon_remote_access.sh's own
two equivalent pipelines (wireguard_status, netbird_status) were
written with `|| true` from the start once the pattern was identified.
Verified:
- New scratch/stub test for addon_remote_access.sh, with curl stubbed
separately from sudo (Tailscale/Netbird's install scripts must never
reach the real network regardless of what sudo intercepts) and a
belt-and-suspenders `sh` stub in case anything got past curl: full
status/menu-builder coverage for all four sub-areas in their real,
unstubbed "not installed" state (none of the four tools exist in this
sandbox); VNC install/change-password/uninstall with systemd unit
content verified (correct $KIOSK_USER/$KIOSK_HOME substitution);
WireGuard install, paste-config (content written correctly to scratch
$WIREGUARD_DIR), and uninstall - including documenting a genuine
cat-until-EOF test-harness limitation (a redirected pipe's EOF is
permanent for the whole stream, unlike a real terminal's per-read
Ctrl+D, so only the config's *default* name is testable through
simple stdin redirection - inherent to the design, matches the legacy
script's identical `cat`-based approach, not a bug); Tailscale and
Netbird install/connect-interactive/connect-with-key/uninstall; and
all four cancel paths confirmed to make zero sudo calls.
- Full regression: re-ran all 11 prior scratch/stub suites after the
lib/menu.sh and power_schedule.sh changes - all still clean.
- End-to-end: ran the real install.sh as a genuine non-root, non-
"kiosk" user through Addons -> Remote Access -> all four sub-menus in
turn, each showing accurate real (unstubbed) "not installed" status,
selecting Install, declining the confirmation, and returning cleanly
- zero invalid-choice errors, clean exit code 0.
Claude
0454a259fa